00. Exposing a Currently Active Kaseya Ransomware Domains Portfolio - An OSINT 
Analysis 


01. Introduction to WHOIS XML API 


WhoisXML API is one of the Web’s and the security industry’s primary destinations for threat 
intelligence and cybercrime research including OSINT type of domain IP and current and 
historical WHOIS data records with billions of domain IP and WHOIS records within WhoisXML 
API’s database where novice and experienced cybercrime researchers threat intelligence 
analysts including OSINT experts and analysts should consider adopting WhoisXML API's in 
their arsenal of OSINT tools and public database repositories and databases largely considering 
the tool as their primary information source and threat intelligence gathering tool and publicly 
accessible database in terms of using it in their current and ongoing OSINT and cybercrime 
including threat intelligence type of investigations. 


02. How to get a proper account 


Cybercrime researchers and threat intelligence analysts interested in obtaining access to one of 
the Web’s and the industry’s most comprehensive and in-depth data set of real-time and 
historical domain IP and WHOIS information should grab an account from the following URL - 
httos://main.whoisxmlapi.com/signup for the purpose of beginning their OSINT and cybercrime 
research including their threat hunting and threat intelligence gathering process. 


Product Tier 1 Tier 2 Tier 3 Tier 4 Tier 5 Tier 6 Units 

WHOIS and Bulk WHOIS 100,000 500,000 1,000,000 2,000,000 5,000,000 10,000,000 Monthly queries 
Domain Availability 100,000 500,000 1,000,000 2,000,000 5,000,000 10,000,000 Monthly queries 
IP Geolocation 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
IP Netblocks 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
DNS Lookup 100,000 200,000 500,000 1,000,000 2,000,000 4,000,000 Monthly queries 
Email Verification 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
Domain Reputation 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
Website Categorization 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 
Website Contacts 50,000 100,000 200,000 500,000 1,000,000 2,000,000 Monthly queries 


Sample WhoisXML API Pricing Plans Web Site 


03. How to install Maltego 


For the purpose of this case study we’ll use the popular OSINT gathering and enrichment tool 

Maltego which you can grab from the following URL - https://www.maltego.com/downloads/ on 
your way to begin using and utilizing WhoisXML API’s advanced domain IP and historical and 

current WHOIS information and one of the Web’s and the industry’s most comprehensive and 

in-depth database. 


= Maltego for Windows 


SELECT A FILE TYPE 


.exe + Java (x64) v 


https://maltego-downloads.s3.... b 


You can view our change loghere > 


Java 11 64 bit is recommended. 


Sample Maltego Download Web Site 


04. How to use the WHOIS XML API Maltego Integration 


thefres hs tuffs .st 


To Domains and IP Addresses (Historical Reverse WHOIS Search) [WhoisXML] 


To Domains and IP Addresses (Reverse WHOIS Search) [WhoisXML] 
0:40:02 UTC 


hos tingerzs.net 


SUOJSUeI | 


To Historical WHOIS Records [WhoisXML] 


To WHOIS Records [WhoisXML] 


Before using Maltego users should follow the instructions and grab a proper WhoisXML API 
account which they can later one use for the actual research and OSINT research and analysis 
including the actual enrichment process. 


05. The Case Study 


We've recently came across to a currently active Kaseya C&C server domains portfolio and 
we've decided to run them against WhoisXML API's vast and in-depth WHOIS database in 
combination with Maltego for the purpose of offering practical and relevant cyber attack and 
cyber campaign attribution technical details which could greatly assist U.S Law Enforcement on 
its way to track down and prosecute the cybercriminals behind these campaigns. 


In this case study we’ll take a look at some of the currently active Kaseya C&C server domains 
and offer practical and relevant threat intelligence and cyber attack attribution detail in terms of 
possible domain registrant email addresses and attempt to look for additional clues in terms of 
cyber attack attribution. 
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Sample domain registrant email addresses known to have been involved in the 


campaign: 
tonyswizs@yahoo[.]com 
alex@unim[.]su 

Ibjlaq@qq[.Jcom 
vmiville@upaf[.]qc[.]ca 
stylesr@ilcdover[.]Jcom 
hector_estrada2108@hotmail[.Jcom 
slee@ckt21[.]com 
DUPONTSELLSHOMES@GMAIL[.]COM 
liemnguyenmt7979@gmail[.Jcom 
sina@lloydconstruction[.Jcom 
traducteur@wanadoo[. |fr 
mmgdudouaisis@laposte[.]net 
infactdomains@gmail[.]Jcom 
jgasbarre@gasbarre[.]com 
lou@ohidesign[.]Jcom 
edv@leober{. Jat 
projetosonline[.Jadao@gmail[.]Jcom 


SLOBODATOMAS12@GMAIL[.]COM 
adultgamezone@mail[.]Jcom 
sompovade@gmail[.]Jcom 
andrei@stingraybeach[.]Jcom 
hashkasolutindo@gmail[.]Jcom 
fcd163@gmail[.]Jcom 
actiglass83@gmail[.]Jcom 
thierry[.]m@medias-talents[.]com 
xuanthien230591 @gmail[.Jcom 
ngoc[.]phampro91@gmail[.]Jcom 
drinkseedhk@gmaill.]Jcom 
adietyarah@gmail[.Jcom 
Phamthanhson1977@gmail[.Jcom 
insp[.]Jburundi@gmail[.Jcom 
a/19aa@maill.]ru 
imadarchid@gmail[.Jcom 
promosite@gmaill[.]com 
pawsupetsalon@gmail[.]Jcom 
MONTRECORDS@GMAIL[.JCOM 
alex[.]trespaille@allianz[. ]fr 
scottr@crowcanyon|[.]com 
claude[.]demuth@lu-cix[.]lu 
dbeciani@hotmail[.Jcom 
Patronhost@gmail[.Jcom 
yves@penverne[.Jorg 
rhillenterprisesinc@gmail[.]com 
whitesoftx@gmail[.]Jcom 
s[.]barreau@esope-net[.]com 
kortiggg2@free[.]email-pool[.Jde 
kukmin@gmail[.Jcom 
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Sample Kaseya C&C server domains known to have been involved in the campaign: 


101gowrie[.]Jcom 
123vrachi[.]Jru 
12starhd[.Jonline 
1kbk[.Jcom[.Jua 
1team[.Jes 

2ekeus[.]n| 
321play[.]com[.]hk 
35-40konkatsu[.]net 
365questions|.Jorg 
4net[.]guru 
4youbeautysalon[.Jcom 
8449nohate[.Jorg 
DupontSellsHomes[.]Jcom 
aakritpatell[.Jcom 
aarvorg[.]Jcom 
abitur-undwieweiter[.]de 
abli[.]net 
abogadoengijon[.Jes 
abogados-en-alicante[.Jes 
abogadosaccidentetraficosevilla[.Jes 
abogadosadomicilio[.Jes 
abuelos[.Jcom 
accountancywijchen[. ]n| 
aco-media[.]nl 


acomprarseguidores[.]Jcom 
actecfoundation[.Jorg 
admos-gleitlager[.]de 
adoptioperheet|. |fi 
adultgamezone[.]com 
advizewealth[.]com 
advokathuset[.]dk 
agence-chocolat-noir[.]Jcom 
agence-referencement-naturel-geneve[.]net 
aglend[.]Jcom[.Jau 
ahouseforlease[.]com 
ai-sptl.]jp 
airconditioning-waalwijk[.]nl 
alfa-stroy72[.Jcom 
alhashen[.]net 
all-turtles[.Jcom 
allamatberedare[.|se 
allentownpapershow[.]com 
allfortheloveofyou[.]com 
allure-cosmetics[.Jat 
almosthomedogrescue[.]dog 
alsace-first[.]Jcom 
alten-mebel63[.]ru 
alvinschwartz[.]wordpress[.]Jcom 
alysonhoward[.]com 
americafirstcommittee[.]Jorg 
amerikansktgodis[.]se 
aminaboutique247[.]com 
ampisolabergegg([.]it 
amylendscrestview[.]com 
analiticapublica[.Jes 
andersongilmour[.]co[.]uk 
aniblinova[.]wordpress[.]Jcom 
answerstest[.]ru 
antenanavil.]com 
anteniti[.Jcom 
anthonystreetrimming[.]Jcom 
antiaginghealthbenefits[.]Jcom 
antonmack[.]de 
anybookreader[.]de 
aodaichandung[.]com 
apolomarcas[.]com 
apprendrelaudit[.]com 
appsformacpc[.]Jcom 


aprepol[.Jcom 
architecturalfiberglass[.Jorg 
architekturbuero-wagner[.]net 
argenblogs[.]com[.Jar 
argos[.]wityu[.]fund 
art2gointerieurprojecten[.]n! 
artallnightdc[.Jcom 
arteservicefabbro[.]com 
artige[.Jcom 
artotelamsterdam[.]com 
aselbermachen[.]com 
asgestion[.]Jcom 
asiluxury[.]Jcom 
associacioesportivapolitg[.]cat 
associationanalytics[.]Jcom 
assurancesalextrespaille[.]fr 
asteriag[.]Jcom 

atalentl. fi 
ateliergamila[.Jcom 
atmos-show[.]com 
atozdistribution[.]co[.Juk 
augenta[.Jcom 

aunexis[.]ch 
aurum-juweliere[.]de 
ausair[.]Jcom[.Jau 
ausbeverage[.]com[.Jau 
austinichurch[.]com 
autodemontagenijmegen[.]nl 
autodujos[. ]It 
autofolierung-lu[.Jde 
autopfand24[.]de 
babcockchurch[.]Jorg 
backstreetpub[.]Jcom 
bafuncs[.Jorg 
balticdentists[.Jcom 
balticdermatology[.]lt 
baptisttabernacle[.]com 
bargningavesta[.]se 
bargningharnosand[.]se 
baronloan[.]Jorg 
basisschooldezonnewijzer[.]nl 
bastutunnan[.]se 
bauertree[.]Jcom 
baumkuchenexpoJ.]jp 


baustb[.]de 
baylegacy[.Jcom 
bayoga[.]co[.]uk 
bbsmobler[.]se 
beaconhealthsystem[.Jorg 
beautychance[.]se 
bee4win[.]Jcom 
behavioralmedicinespecialists[.]com 
berlin-bamboo-bikes[.]org 
berliner-versicherungsvergleich[.]Jde 
bestbet[.]Jcom 
besttechie[.]Jcom 
better[.]town 
beyondmarcomdotcom[.]wordpress[.]Jcom 
bhwlawfirm[.Jcom 
biapi-coaching[.]fr 
bierensgebakkramen{[. Jnl 
bigasgrup[.]Jcom 
bigbaguettes[.Jeu 
bigler-hrconsulting[.]ch 
bildungsunderlebnis[.]haus 
bimnapratica[.]com 
binder-buerotechnik[.Jat 
bingonearme[.]org 
biortaggivaldelsa[.Jcom 
birnam-wood[.]Jcom 
blacksirius[.Jde 
blewback[.]com 

blgr[.]be 
blog[.Jsolutionsarchitect[.]guru 
blogdecachorros[.]com 
bloggyboulga[.]net 
blood-sports[.]net 
blossombeyond50[.]com 
blumenhof-wegleitner[.Jat 
bockampf[.]com 
body-armour{[.Jonline 
body-guards[. Jit 
bodyforwife[.]com 
bodyfulls[.]Jcom 
bogdanpeptine[.]ro 
boisehosting[.]net 
boldcitydowntown[.]com 
bookspeopleplaces[.]com 


boompinoy[.]com 
boosthybrid[.]com[.Jau 
bordercollie-nim[.]n| 
botanicinnovations[.]com 
bouldercafe-wuppertal[.]de 
boulderwelt-muenchen-west[.]de 
bouncingbonanza[.]Jcom 
bouquet-de-roses[.]Jcom 
bowengroup[.]com[.]au 
bptdmaluku[.]Jcom 
bradynursery[.]Jcom 
braffinjurylawfirm[.Jcom 
brandl-blumen[.]de 
brawnmediany[.]com 
brevitempore[.]net 
bricotienda[.]com 
bridgeloanslenders[.]com 
brigitte-erler[.Jcom 
bristolaeroclub[.]co[.Juk 
broseller[.Jcom 
bsaship[.]Jcom 
bunburyfreightservices[.]com[.Jau 
bundabergeyeciinic[.]Jcom[.Jau 
burkert-ideenreich[.]de 
buroludof.]nl 
buymedicall.]biz 

bxdf[.]info 

c-a[.Jco[.]Jin 
c2e-poitiers[.]Jcom 
cactusthebrand[.]com 
cafemattmeera|[.Jcom 
caffeinternetL. Jit 
calabasasdigest[.]Jcom 
calxplus[.Jeu 
campus2day[.|de 
campusoutreach[.]org 
camsadviser[.]com 
candyhouseusa[.]com 
caribbeansunpoker[.]Jcom 
caribdoctor[.Jorg 
carlosja[.Jcom 
carolinepenn[.Jcom 
carriagehousesalonvt[.]Jcom 
carrybrands[.]n| 


castillobalduz[.Jes 
catholicmusicfest[.]Jcom 
ccpbroadband[.]com 
ceid[.]info[.]tr 

celeclub[.]Jorg 

celularity[.]com 
centromarysalud[.Jcom 
centrospgolega|[.]com 
centuryrs[.]Jcom 
cerebralforce[.]net 
ceres[.Jorg[.Jau 
chandlerpd[.]com 
chaotrang[.]Jcom 
charlesreger[.]Jcom 
charlottepoudroux-photographie[.]fr 
chatizel-paysage[.]fr 
chavesdoareeiro[.]com 
chefdays[.Jde 

cheminpsy[.]fr 
chrissieperry[.Jcom 
christ-michael[.]net 
christinarebuffetcourses[.]com 
cimanchesterescorts[.]co[.Juk 
cirugiauretra[.Jes 
cite4me[.Jorg 

citymax-cr[.Jcom 
cityorchardhtx[.]Jcom 
classycurtainsltd[.]co[.Juk 
cleliaekiko[.Jonline 
clos-galant[.]Jcom 

cnoia[.Jorg 
coastalbridgeadvisors[.]Jcom 
coding-machine[.]Jcom 
coding-marking[.]Jcom 
coffreo[.]biz 
collaborativeclassroom[.]org 
colorofhorses[.]Jcom 
comarenterprises[.]com 
commercialboatbuilding[.Jcom 
commongrounc-stories[.]Jcom 
comparatif-lave-linge[. }fr 
completeweddingkansas[.]Jcom 
compliancesolutionsstrategies[.]Jcom 
conasmanagemen|{.]de 


conexa4papers|. |trade 
connectedace[.]com 
consultaractadenacimiento[.]Jcom 
controldekk[.]Jcom 
copystar[.]co[.Juk 
corelifenutrition[.Jcom 
corendonhotels[.]com 
corolal[.Jes 
corona-handles[.]Jcom 
cortec-neuro[.]com 
coursio[.]Jcom 
courteney-cox[.]net 
craftleathermnl[.]com 
craigmccabe[.]fun 
craigvalentineacademy|[.]Jcom 
cranleighscoutgroup[.Jorg 
creamery201[.]com 
creative-waves[.]co[.]uk 
crediacces[.]com 
croftprecision[.]co[.]uk 
crosspointefellowship[.]church 
crowcanyon[.]com 
crowd-patch[.]co[.]Juk 
csgospeltips[.]se 

ctrler[.Jcn 

cuppacap].]Jcom 
cursoporcelanatoliquido[.Jonline 
cursosgratuitosnainternet[.]com 
cuspdentall[.Jcom 
cwsitservices[.]co[.Juk 
cyntox[.]Jcom 

d1franchise[.]Jcom 
d2marketing[.]co[.Juk 
daklesal[.]de 
danholzmann[.]com 
daniel-akermann-architektur-und-planung[.]ch 
danielblum[.]Jinfo 
danskretursystem[.]dk 
danubecloud[.]Jcom 
dareckleyministries[.]com 
darnallwellbeing[.Jorg[.Juk 
darrenkeslerministries[.]com 
datacenters-in-europe[.]com 
deepsouthclothingcompany[.]Jcom 


degroenetunnell[.]Jcom 
dekkinngay[.]Jcom 
deko4you. Jat 
delawarecorporatelaw[.]com 
delchacay[.]com[.Jar 
deltacleta[.]Jcat 
denifl-consulting[.Jat 
denovofoodsgroup[.]Jcom 
deoudedorpskernnoordwijk[.]nl 
deprobatehelp[.Jcom 
deschl[.]net 
desert-trails[.Jcom 
despedidascostablanca[.Jes 
destinationclients[.]fr 
devlaur[.]Jcom 

devok[.]info 

devstyle[.Jorg 

dezatec[.Jes 
digi-talents[.]Jcom 
digivod[.Jde 

dinslips[.Jse 
directwindowco[.]com 
dirittosanitario[.]biz 

ditog[.]fr 
div-vertriebsforschung[.]de 
diversiapsicologia[.Jes 
dic[.]berlin 
dnepr-beskid[.]com[.]ua 
dontpassthepepper[.Jcom 
dpo-as-a-service[.]com 
dr-pipi[.]de 
dr-seleznev[.]Jcom 
dr-tremel-rednitzhembach[.]de 
dramagickcom[.]wordpress[.]com 
drfoyle[.Jcom 
drinkseed[.Jcom 

drnice[.Jde 

drugdevice[.]Jorg 

dsl-ip[.]Jde 

dublikator[.Jcom 
dubnew[.]com 
dubscollective[.Jcom 
durganews[.]com 
dushkaf[.]ua 


dutchbrewingcoffee[.Jcom 
dutchcoder{.]n! 

dw-css[.]de 
eadsmurraypugh[.]Jcom 
eaglemeetstiger[.]de 
easytrans[.]com[.Jau 
echtveilig[.]n! 
eco-southafrica[.]Jcom 
ecoledansemulhouse[.]fr 
ecopro-kanto[.]Jcom 
ecpmedia[.]vn 

edelman|[.]jp 
edgewoodestates[.]org 
edrcreditservices[.]nl 
educar[.]org 

edv-live[.Jde 
effortlesspromo[.]Jcom 
eglectonk[.Jonline 
elimchan[.]Jcom 

elpal[.Jse 

em-gmbh[.]ch 
embracinghiscall[.]Jcom 
employeesurveys[.]com 
enovos[.]de 

entopic[.Jcom 
epwritescom[.]wordpress[.]Jcom 
eraorastudio[.]Jcom 
erstatningsadvokaterne[.]dk 
esope-formation[. ]fr 
euro-trend].]p! 
evangelische-pfarrgemeinde-tuniberg[.]de 
evergreen-fishing[.]com 
evologic-technologies[.]com 
executiveairllc[.Jcom 
exenberger[.]at 
expandet[.]dk 
extensionmaison|[. info 
extraordinaryoutdoors[.]com 
facettenreich27[.]de 
fairfriends18[.]de 
faizanullah[.]Jcom 

falcou[. }fr 
familypark40[.]Jcom 
fannmedias[.]Jcom 


farhaani[.Jcom 
faroairporttransfers[.]net 
faronics[.]Jcom 
fatfreezingmachines[.]com 
fax-payday-loans[.]com 
fayrecreations[.Jcom 
femxarxa[.]cat 
fensterbau-ziegler[.]de 
fibrofolliculoma].]info 
figura[.]team 
filmstreamingvfcomplet[.]be 
filmvideoweb[.]Jcom 
financescorecard[.]Jcom 
finde-deine-marke|[.]de 
finediningweek[.]p! 
first-2-aid-u[.]Jcom 
firstpaymentservices[.]com 
fiscalsort[.]Jcom 
fitnessbazaar[.]Jcom 
fitnessingbyjessica[.]com 
fitovitaforum[.Jcom 
fizzl[.Jru 

flexicloud[.]hk 
forestlakeuca[.Jorg[.Jau 
foretprivee[.]ca 
forskolorna[.Jorg 
foryourhealth[.]live 
fotoideaymedia[.Jes 
fotoscondron[.]Jcom 
fransespiegels[.]nl 
freie-baugutachterpraxis[.]de 
freie-gewerkschaften[.]de 
friendsandbrgrs[.]com 
frontierweldingllc[.Jcom 
ftf[.Jor[. Jat 

ftlcL.Jes 
fundaciongregall.Jorg 
funjose[.Jorg][.]gt 
gadgetedges[.]com 
gaian[.]n! 
galleryartfair[.Jcom 
galserwis[.]pl 
gamesboard[.]info 
gantungankunciakrilikbandung[.Jcom 


garage-lecompte-rouen|[. ]fr 
gasbarre[.]Jcom 
gasolspecialisten[.]se 
gastsicht[.]Jde 

geekwork[.]pl 

geisterradler[.Jde 
gemeentehetkompas[.]nl 
geoffreymeuli[.]Jcom 
girlillamarketing[.Jcom 
glennroberts[.]co[.]nz 
global-kids[.]info 
globedivers[.]wordpress[.]Jcom 
gmto[. |fr 

gonzalezfornes[.]Jes 
goodgirlrecovery[.]Jcom 
gopackapp[.]com 

gporf[.]fr 

gratispresent[.]se 
greenfieldoptimaldentalcare[.]Jcom 
greenko[.]pl 

greenpark[.]ch 
grelot-home[.]com 
groupe-cets[.]Jcom 
groupe-frayssinetL. ]fr 
grupocarvalhoerodrigues[.]com[.]br 
gw2guilds[.Jorg 
gymnasedumanagement[.]Jcom 
haar-spange[.]Jcom 
hairnetty[.Jwordpress[.]com 
hairstylesnow[.]site 
handi-jack-lIc[.]com 
hannah-fink[.]Jde 
happyeasterimages[.]Jorg 
hardinggroup[.]com 
haremnick[.]com 
harpershologram[.]wordpress[.]Jcom 
harveybp[.]Jcom 
hashkasolutindo[.]com 
hatech[.]io 
havecamerawilltravel201 7[.]wordpress[.]Jcom 
healthyyworkout[.]com 
hebkft[.]hu 
heidelbergartstudio[.]gallery 
helenekowalsky[.]com 


helikopterviuchtnewyork[.]n! 
heliomotion[.]Jcom 
hellohope[.]Jcom 
henricekupper[.]com 
herbayupro[.]Jcom 
herbstfeststaefa[.]ch 
heurigen-bauer[.]Jat 
hexcreatives[.]co 
hhcourier[.]com 
hiddencitysecrets[.]Jcom[.]au 
higadograsoweb[.]com 
highimpactoutdoors[.]net 
highlinesouthasc[.]Jcom 
hihaho[.]Jcom 
hkr-reise[.]de 
hmsdanmark[.]dk 
hokagestore[.]Jcom 
homecomingstudio[.]Jcom 
homesdollar[.]Jcom 
homng[.]net 
hoteledenpadova[.]it 
hotelsolbh[.Jcom[.]or 
hotelzentrall[.Jat 
houseofplus[.Jcom 
hrabritelefon[.]Jhr 
htchorst[.]n| 
huehnerauge-entfernen[.]de 
huesges-gruppe[.]de 
hugoversichert[.]de 
huissier-creteil[.]com 
humancondition[.Jcom 
humanityplus[.]Jorg 
hushavefritid[.Jdk 
hvccfloorcare[.]Jcom 
hypozentrum[.Jcom 
i-arslan[.Jde 

i-trust[.]dk 
ianaswanson[.]com 
icpcnj[.Jorg 

id-et-d[.]fr 

id-vet[.Jcom 
idemblogs[.Jcom 
igfap[.Jcom 
igorbarbosa[.]com 


igrealestate[.]Jcom 
ihr-news[.]jp 

ikads[.Jorg 

ilcdover[.]Jcom 

ilive[.JIt 

ilso[.Jnet 

imadarchid[.]com 
imaginado[.]de 
imperfectstore[.]com 
importardechina[.]info 
innote[. }fi 
ino-professional[.]ru 
insidegarage[.]pl 
insigniapmg[.Jcom 

insp[.]bi 

instatron[.]net 

intecwi[.]com 
interactcenter[.Jorg 
international-sound-awards[.]com 
iphoneszervizbudapest[.]hu 
iqbalscientific[.]com 
irinaverwer[.]Jcom 
irishmachineryauctions[.]com 
itelagen[.]Jcom 
ivfminiua[.]Jcom 
iviaggisonciliegie[. ]it 
ivivo[.Jes 

iwelt[.Jde 

iwr[.]nl 

iyahayki[.]nl 
iyengaryogacharlotte[.]com 
izzi360[.]Jcom 
jacquin-maquettes[.]com 
jadwalbolanet|[.]info 
jakekozmor[.]Jcom 
jameskibbie[.]Jcom 
jandaonline[.]Jcom 
jasonbaileystudio[.]Jcom 
jbbjw[.]Jcom 
jeanlouissibomanal[.Jcom 
jenniferandersonwriter[.]com 
jerling[.Jde 

jiloc[.]com 
jobcenterkenyal[.Jcom 
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